Bring Your Own SES

How to connect your AWS SES account to SendFleet

Four steps, a few minutes. No manual approval and no waiting period.

Step 1: Create the role with one click

Open Dashboard → AWS and press Create the role in AWS. AWS CloudFormation opens with a ready-made stack that creates one IAM role, SendFleet-BYOC-Role, with your ExternalId already filled in. Tick the IAM acknowledgement and press Create stack.

Prefer to create it by hand? The dashboard shows the exact trust and permissions policies for your account. The trust policy has this shape:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<SENDFLEET_ACCOUNT_ID>:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "<YOUR_EXTERNAL_ID>" },
        "ArnEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::<SENDFLEET_ACCOUNT_ID>:role/SendFleetByocRelay",
            "arn:aws:iam::<SENDFLEET_ACCOUNT_ID>:role/SendFleetByocControl"
          ]
        }
      }
    }
  ]
}

Step 2: Connect it in SendFleet

Copy RoleArn from the stack's Outputs tab, paste it into Dashboard → AWS and press Connect. SendFleet then:

• →Confirms the role can be used with your ExternalId
• →Checks every AWS region and sends from the one where your SES account has production access (or from a region you choose, for example to keep mail in the EU)
• →Switches on your suppression list and SES Auto Validation, once — after that your choices are yours
• →Reads your SES account: production access, AWS's view of your standing, quota and sending rate
• →Sets up delivery tracking: a configuration set sendfleet-tracking and an SNS topic sendfleet-events, in your account

Step 3: Add a sending domain

Go to Dashboard → Domains → Add BYOC domain and enter your root domain, for example acme.com. SendFleet registers it in your SES account and shows you the records to publish: the ownership TXT token, a second TXT record _sendfleet unique to your account, three DKIM CNAMEs, and the send.yourdomain.com MAIL FROM records. Full detail in the DNS Records guide.

Step 4: Send

Once ownership and DKIM are both verified, the domain is send-ready:

curl -X POST https://api.sendfleet.net/v1/send \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to":         "customer@example.com",
    "from_email": "hello@acme.com",
    "from_name":  "Acme",
    "subject":    "Welcome!",
    "message":    "Thanks for joining Acme."
  }'

# With delivery tracking on, the response carries "mode": "byoc" and an
# "idempotency_key" that every webhook and log entry for this send repeats.

What the role allows

The role cannot read your mail, change IAM, or touch any other resource. Only SendFleet's sending and management services can use it, and only with your ExternalId: 48 hex characters, generated for your account and never changed. That condition is what prevents the confused deputy problem, where anyone who learned your Role ARN could ask us to use it.

Delivery tracking and what we store

AWS bills your account for each event your SNS topic publishes, so you choose what is published. Bounces, complaints and rejections are always on: protection depends on them, and they are rare. Deliveries (about one per recipient, most of the cost) and delays are your choice. "Sent" is free: SendFleet records it itself when SES accepts the message.

With email logs on, every send appears as Queued the moment it is accepted, and turns Failed, with the reason, if it never reaches SES.

If the tracking resources in your account are changed or deleted, SendFleet repairs them — unless you switch automatic repair off, and then it only tells you. If they are removed again soon after a repair, SendFleet assumes you meant it, stops, and emails you. Your mail is never held up by tracking: if the configuration set is missing, the message is still sent, just untracked. Every change SendFleet makes in your account is listed on Dashboard → AWS under Activity in your AWS account.

Production access

New SES accounts can only send to verified addresses, and production access is granted per region. On Dashboard → AWS, pick the region, enter your website and the kind of mail you send, review the description SendFleet drafts, and submit. SendFleet turns on your account-level suppression list first, so the request truthfully describes how bounces and complaints are handled. AWS answers by email to your account contacts, usually within a day; if it asks a follow-up question, the description is a good reply.

Reputation protection

AWS reviews an SES account once its bounce rate reaches 5% or its complaint rate 0.1%. SendFleet watches your rates over 24 hours and 7 days and pauses sending before AWS has to. Choose High, Medium (default), Low or Off; the dashboard shows each level's exact lines. You are warned by email first. While paused, /v1/send returns 403 sending_suspended for your BYOC domains until you press Resume.

Pricing

The BYOC plan is $5 a month with 20,000 emails and 20,000 logged emails included each calendar month (UTC). Beyond that it is $0.10 per 1,000 emails sent and $0.10 per 1,000 emails logged (only while email logs are on), rounded up to the next 1,000 and added to your next invoice. Set a monthly cap on Dashboard → AWS (default 100,000, up to 1,000,000) so usage can never surprise you; sends past it return 429 usage_limit_exceeded. Free BYOC includes 3,000 emails a month with delivery tracking and email logs, but no webhooks. Your AWS SES charges are billed by AWS. See Plans and limits.

Troubleshooting